@azure/msal-browser 3.9.0 → 3.11.0

package/src/controllers/UnknownOperatingContextController.ts

@@ -29,7 +29,7 @@ import { RedirectRequest } from "../request/RedirectRequest";
 import { SilentRequest } from "../request/SilentRequest";
 import { SsoSilentRequest } from "../request/SsoSilentRequest";
 import { AuthenticationResult } from "../response/AuthenticationResult";
-import { ApiId, WrapperSKU, InteractionType } from "../utils/BrowserConstants";
+import { ApiId, WrapperSKU } from "../utils/BrowserConstants";
 import { IController } from "./IController";
 import { UnknownOperatingContext } from "../operatingcontext/UnknownOperatingContext";
 import { CryptoOps } from "../crypto/CryptoOps";
@@ -149,13 +149,13 @@ export class UnknownOperatingContextController implements IController {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     acquireTokenPopup(request: PopupRequest): Promise<AuthenticationResult> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<AuthenticationResult>;
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     acquireTokenRedirect(request: RedirectRequest): Promise<void> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return Promise.resolve();
     }
     acquireTokenSilent(
@@ -163,7 +163,7 @@ export class UnknownOperatingContextController implements IController {
         silentRequest: SilentRequest
     ): Promise<AuthenticationResult> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<AuthenticationResult>;
     }
     acquireTokenByCode(
@@ -171,7 +171,7 @@ export class UnknownOperatingContextController implements IController {
         request: AuthorizationCodeRequest
     ): Promise<AuthenticationResult> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<AuthenticationResult>;
     }
     acquireTokenNative(
@@ -195,7 +195,7 @@ export class UnknownOperatingContextController implements IController {
         accountId?: string | undefined
     ): Promise<AuthenticationResult> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<AuthenticationResult>;
     }
     acquireTokenByRefreshToken(
@@ -205,7 +205,7 @@ export class UnknownOperatingContextController implements IController {
         silentRequest: SilentRequest
     ): Promise<AuthenticationResult> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<AuthenticationResult>;
     }
     addEventCallback(callback: EventCallbackFunction): string | null {
@@ -217,22 +217,22 @@ export class UnknownOperatingContextController implements IController {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     addPerformanceCallback(callback: PerformanceCallbackFunction): string {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return "";
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     removePerformanceCallback(callbackId: string): boolean {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return true;
     }
     enableAccountStorageEvents(): void {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
     disableAccountStorageEvents(): void {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
 
     handleRedirectPromise(
@@ -247,19 +247,19 @@ export class UnknownOperatingContextController implements IController {
         request?: PopupRequest | undefined
     ): Promise<AuthenticationResult> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<AuthenticationResult>;
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     loginRedirect(request?: RedirectRequest | undefined): Promise<void> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<void>;
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     logout(logoutRequest?: EndSessionRequest | undefined): Promise<void> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<void>;
     }
     logoutRedirect(
@@ -267,7 +267,7 @@ export class UnknownOperatingContextController implements IController {
         logoutRequest?: EndSessionRequest | undefined
     ): Promise<void> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<void>;
     }
     logoutPopup(
@@ -275,7 +275,7 @@ export class UnknownOperatingContextController implements IController {
         logoutRequest?: EndSessionPopupRequest | undefined
     ): Promise<void> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<void>;
     }
     ssoSilent(
@@ -292,12 +292,12 @@ export class UnknownOperatingContextController implements IController {
         >
     ): Promise<AuthenticationResult> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Promise<AuthenticationResult>;
     }
     getTokenCache(): ITokenCache {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as ITokenCache;
     }
     getLogger(): Logger {
@@ -306,16 +306,16 @@ export class UnknownOperatingContextController implements IController {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     setLogger(logger: Logger): void {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     setActiveAccount(account: AccountInfo | null): void {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
     getActiveAccount(): AccountInfo | null {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return null;
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -325,45 +325,36 @@ export class UnknownOperatingContextController implements IController {
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     setNavigationClient(navigationClient: INavigationClient): void {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
     getConfiguration(): BrowserConfiguration {
         return this.config;
     }
     isBrowserEnv(): boolean {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return true;
     }
     getBrowserCrypto(): ICrypto {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as ICrypto;
     }
     getPerformanceClient(): IPerformanceClient {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as IPerformanceClient;
     }
     getRedirectResponse(): Map<string, Promise<AuthenticationResult | null>> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
         return {} as Map<string, Promise<AuthenticationResult | null>>;
     }
-    preflightBrowserEnvironmentCheck(
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        interactionType: InteractionType,
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        isAppEmbedded?: boolean | undefined
-    ): void {
-        blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
-    }
 
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     async clearCache(logoutRequest?: ClearCacheRequest): Promise<void> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
 
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -378,6 +369,6 @@ export class UnknownOperatingContextController implements IController {
             | PopupRequest
     ): Promise<void> {
         blockAPICallsBeforeInitialize(this.initialized);
-        blockNonBrowserEnvironment(this.isBrowserEnvironment);
+        blockNonBrowserEnvironment();
     }
 }

package/src/crypto/BrowserCrypto.ts

@@ -13,6 +13,7 @@ import {
     PerformanceEvents,
 } from "@azure/msal-common";
 import { KEY_FORMAT_JWK } from "../utils/BrowserConstants";
+import { urlEncodeArr } from "../encode/Base64Encode";
 
 /**
  * This file defines functions used by the browser library to perform cryptography operations such as
@@ -202,3 +203,13 @@ export async function sign(
         data
     ) as Promise<ArrayBuffer>;
 }
+
+/**
+ * Returns the SHA-256 hash of an input string
+ * @param plainText
+ */
+export async function hashString(plainText: string): Promise<string> {
+    const hashBuffer: ArrayBuffer = await sha256Digest(plainText);
+    const hashBytes = new Uint8Array(hashBuffer);
+    return urlEncodeArr(hashBytes);
+}

package/src/crypto/CryptoOps.ts

@@ -20,7 +20,7 @@ import {
     createBrowserAuthError,
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError";
-import { CryptoKeyStore } from "../cache/CryptoKeyStore";
+import { AsyncMemoryStorage } from "../cache/AsyncMemoryStorage";
 
 export type CachedKeyPair = {
     publicKey: CryptoKey;
@@ -44,13 +44,13 @@ export class CryptoOps implements ICrypto {
 
     private static POP_KEY_USAGES: Array<KeyUsage> = ["sign", "verify"];
     private static EXTRACTABLE: boolean = true;
-    private cache: CryptoKeyStore;
+    private cache: AsyncMemoryStorage<CachedKeyPair>;
 
     constructor(logger: Logger, performanceClient?: IPerformanceClient) {
         this.logger = logger;
         // Browser crypto needs to be validated first before any other classes can be set.
         BrowserCrypto.validateCryptoAvailable(logger);
-        this.cache = new CryptoKeyStore(this.logger);
+        this.cache = new AsyncMemoryStorage<CachedKeyPair>(this.logger);
         this.performanceClient = performanceClient;
     }
 
@@ -121,7 +121,7 @@ export class CryptoOps implements ICrypto {
             await BrowserCrypto.importJwk(privateKeyJwk, false, ["sign"]);
 
         // Store Keypair data in keystore
-        await this.cache.asymmetricKeys.setItem(publicJwkHash, {
+        await this.cache.setItem(publicJwkHash, {
             privateKey: unextractablePrivateKey,
             publicKey: keyPair.publicKey,
             requestMethod: request.resourceRequestMethod,
@@ -142,8 +142,8 @@ export class CryptoOps implements ICrypto {
      * @param kid
      */
     async removeTokenBindingKey(kid: string): Promise<boolean> {
-        await this.cache.asymmetricKeys.removeItem(kid);
-        const keyFound = await this.cache.asymmetricKeys.containsKey(kid);
+        await this.cache.removeItem(kid);
+        const keyFound = await this.cache.containsKey(kid);
         return !keyFound;
     }
 
@@ -151,7 +151,29 @@ export class CryptoOps implements ICrypto {
      * Removes all cryptographic keys from IndexedDB storage
      */
     async clearKeystore(): Promise<boolean> {
-        return this.cache.clear();
+        // Delete in-memory keystores
+        this.cache.clearInMemory();
+
+        /**
+         * There is only one database, so calling clearPersistent on asymmetric keystore takes care of
+         * every persistent keystore
+         */
+        try {
+            await this.cache.clearPersistent();
+            return true;
+        } catch (e) {
+            if (e instanceof Error) {
+                this.logger.error(
+                    `Clearing keystore failed with error: ${e.message}`
+                );
+            } else {
+                this.logger.error(
+                    "Clearing keystore failed with unknown error"
+                );
+            }
+
+            return false;
+        }
     }
 
     /**
@@ -169,7 +191,7 @@ export class CryptoOps implements ICrypto {
             PerformanceEvents.CryptoOptsSignJwt,
             correlationId
         );
-        const cachedKeyPair = await this.cache.asymmetricKeys.getItem(kid);
+        const cachedKeyPair = await this.cache.getItem(kid);
 
         if (!cachedKeyPair) {
             throw createBrowserAuthError(
@@ -227,11 +249,7 @@ export class CryptoOps implements ICrypto {
      * @param plainText
      */
     async hashString(plainText: string): Promise<string> {
-        const hashBuffer: ArrayBuffer = await BrowserCrypto.sha256Digest(
-            plainText
-        );
-        const hashBytes = new Uint8Array(hashBuffer);
-        return urlEncodeArr(hashBytes);
+        return BrowserCrypto.hashString(plainText);
     }
 }
 

package/src/index.ts

@@ -147,6 +147,8 @@ export {
     // Telemetry
     InProgressPerformanceEvent,
     TenantProfile,
+    IPerformanceClient,
+    StubPerformanceClient,
 } from "@azure/msal-common";
 
 export { version } from "./packageMetadata";

package/src/interaction_client/BaseInteractionClient.ts

@@ -9,8 +9,6 @@ import {
     Logger,
     AccountInfo,
     AccountEntity,
-    BaseAuthRequest,
-    AuthenticationScheme,
     UrlString,
     ServerTelemetryManager,
     ServerTelemetryRequest,
@@ -21,7 +19,6 @@ import {
     AuthorityFactory,
     IPerformanceClient,
     PerformanceEvents,
-    StringUtils,
     AzureCloudOptions,
     invokeAsync,
 } from "@azure/msal-common";
@@ -133,69 +130,6 @@ export abstract class BaseInteractionClient {
         }
     }
 
-    /**
-     * Initializer function for all request APIs
-     * @param request
-     */
-    protected async initializeBaseRequest(
-        request: Partial<BaseAuthRequest>
-    ): Promise<BaseAuthRequest> {
-        this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.InitializeBaseRequest,
-            this.correlationId
-        );
-        const authority = request.authority || this.config.auth.authority;
-
-        const scopes = [...((request && request.scopes) || [])];
-
-        const validatedRequest: BaseAuthRequest = {
-            ...request,
-            correlationId: this.correlationId,
-            authority,
-            scopes,
-        };
-
-        // Set authenticationScheme to BEARER if not explicitly set in the request
-        if (!validatedRequest.authenticationScheme) {
-            validatedRequest.authenticationScheme = AuthenticationScheme.BEARER;
-            this.logger.verbose(
-                'Authentication Scheme wasn\'t explicitly set in request, defaulting to "Bearer" request'
-            );
-        } else {
-            if (
-                validatedRequest.authenticationScheme ===
-                AuthenticationScheme.SSH
-            ) {
-                if (!request.sshJwk) {
-                    throw createClientConfigurationError(
-                        ClientConfigurationErrorCodes.missingSshJwk
-                    );
-                }
-                if (!request.sshKid) {
-                    throw createClientConfigurationError(
-                        ClientConfigurationErrorCodes.missingSshKid
-                    );
-                }
-            }
-            this.logger.verbose(
-                `Authentication Scheme set to "${validatedRequest.authenticationScheme}" as configured in Auth request`
-            );
-        }
-
-        // Set requested claims hash if claims-based caching is enabled and claims were requested
-        if (
-            this.config.cache.claimsBasedCachingEnabled &&
-            request.claims &&
-            // Checks for empty stringified object "{}" which doesn't qualify as requested claims
-            !StringUtils.isEmptyObj(request.claims)
-        ) {
-            validatedRequest.requestedClaimsHash =
-                await this.browserCrypto.hashString(request.claims);
-        }
-
-        return validatedRequest;
-    }
-
     /**
      *
      * Use to get the redirect uri configured in MSAL or null.

package/src/interaction_client/NativeInteractionClient.ts

@@ -262,6 +262,7 @@ export class NativeInteractionClient extends BaseInteractionClient {
             const fullAccount = {
                 ...account,
                 idTokenClaims: result?.idTokenClaims as TokenClaims,
+                idToken: result?.idToken,
             };
 
             return {
@@ -416,24 +417,33 @@ export class NativeInteractionClient extends BaseInteractionClient {
             "NativeInteractionClient - handleNativeResponse called."
         );
 
-        if (response.account.id !== request.accountId) {
-            // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
-            throw createNativeAuthError(NativeAuthErrorCodes.userSwitch);
-        }
-
-        // Get the preferred_cache domain for the given authority
-        const authority = await this.getDiscoveredAuthority(request.authority);
-
         // generate identifiers
         const idTokenClaims = AuthToken.extractTokenClaims(
             response.id_token,
             base64Decode
         );
+
         const homeAccountIdentifier = this.createHomeAccountIdentifier(
             response,
             idTokenClaims
         );
 
+        const cachedhomeAccountId =
+            this.browserStorage.getAccountInfoFilteredBy({
+                nativeAccountId: request.accountId,
+            })?.homeAccountId;
+
+        if (
+            homeAccountIdentifier !== cachedhomeAccountId &&
+            response.account.id !== request.accountId
+        ) {
+            // User switch in native broker prompt is not supported. All users must first sign in through web flow to ensure server state is in sync
+            throw createNativeAuthError(NativeAuthErrorCodes.userSwitch);
+        }
+
+        // Get the preferred_cache domain for the given authority
+        const authority = await this.getDiscoveredAuthority(request.authority);
+
         const baseAccount = buildAccountToCache(
             this.browserStorage,
             authority,
@@ -601,9 +611,18 @@ export class NativeInteractionClient extends BaseInteractionClient {
         const accountInfo: AccountInfo | null = updateAccountTenantProfileData(
             accountEntity.getAccountInfo(),
             undefined, // tenantProfile optional
-            idTokenClaims
+            idTokenClaims,
+            response.id_token
         );
 
+        /**
+         * In pairwise broker flows, this check prevents the broker's native account id
+         * from being returned over the embedded app's account id.
+         */
+        if (accountInfo.nativeAccountId !== response.account.id) {
+            accountInfo.nativeAccountId = response.account.id;
+        }
+
         // generate PoP token as needed
         const responseAccessToken = await this.generatePopAccessToken(
             response,

package/src/interaction_client/SilentCacheClient.ts

@@ -7,13 +7,9 @@ import { StandardInteractionClient } from "./StandardInteractionClient";
 import {
     CommonSilentFlowRequest,
     SilentFlowClient,
-    ServerTelemetryManager,
-    AccountInfo,
-    AzureCloudOptions,
     PerformanceEvents,
     invokeAsync,
 } from "@azure/msal-common";
-import { SilentRequest } from "../request/SilentRequest";
 import { ApiId } from "../utils/BrowserConstants";
 import {
     BrowserAuthError,
@@ -39,12 +35,22 @@ export class SilentCacheClient extends StandardInteractionClient {
             ApiId.acquireTokenSilent_silentFlow
         );
 
-        const silentAuthClient = await this.createSilentFlowClient(
+        const clientConfig = await invokeAsync(
+            this.getClientConfiguration.bind(this),
+            PerformanceEvents.StandardInteractionClientGetClientConfiguration,
+            this.logger,
+            this.performanceClient,
+            this.correlationId
+        )(
             serverTelemetryManager,
             silentRequest.authority,
             silentRequest.azureCloudOptions,
             silentRequest.account
         );
+        const silentAuthClient = new SilentFlowClient(
+            clientConfig,
+            this.performanceClient
+        );
         this.logger.verbose("Silent auth client created");
 
         try {
@@ -86,50 +92,4 @@ export class SilentCacheClient extends StandardInteractionClient {
         const validLogoutRequest = this.initializeLogoutRequest(logoutRequest);
         return this.clearCacheOnLogout(validLogoutRequest?.account);
     }
-
-    /**
-     * Creates an Silent Flow Client with the given authority, or the default authority.
-     * @param serverTelemetryManager
-     * @param authorityUrl
-     */
-    protected async createSilentFlowClient(
-        serverTelemetryManager: ServerTelemetryManager,
-        authorityUrl?: string,
-        azureCloudOptions?: AzureCloudOptions,
-        account?: AccountInfo
-    ): Promise<SilentFlowClient> {
-        // Create auth module.
-        const clientConfig = await invokeAsync(
-            this.getClientConfiguration.bind(this),
-            PerformanceEvents.StandardInteractionClientGetClientConfiguration,
-            this.logger,
-            this.performanceClient,
-            this.correlationId
-        )(serverTelemetryManager, authorityUrl, azureCloudOptions, account);
-        return new SilentFlowClient(clientConfig, this.performanceClient);
-    }
-
-    async initializeSilentRequest(
-        request: SilentRequest,
-        account: AccountInfo
-    ): Promise<CommonSilentFlowRequest> {
-        this.performanceClient.addQueueMeasurement(
-            PerformanceEvents.InitializeSilentRequest,
-            this.correlationId
-        );
-
-        const baseRequest = await invokeAsync(
-            this.initializeBaseRequest.bind(this),
-            PerformanceEvents.InitializeBaseRequest,
-            this.logger,
-            this.performanceClient,
-            this.correlationId
-        )(request);
-        return {
-            ...request,
-            ...baseRequest,
-            account: account,
-            forceRefresh: request.forceRefresh || false,
-        };
-    }
 }

package/src/interaction_client/SilentIframeClient.ts

@@ -93,15 +93,20 @@ export class SilentIframeClient extends StandardInteractionClient {
             );
         }
 
-        // Check that prompt is set to none or no_session, throw error if it is set to anything else.
-        if (
-            request.prompt &&
-            request.prompt !== PromptValue.NONE &&
-            request.prompt !== PromptValue.NO_SESSION
-        ) {
-            throw createBrowserAuthError(
-                BrowserAuthErrorCodes.silentPromptValueError
-            );
+        // Check the prompt value
+        const inputRequest = { ...request };
+        if (inputRequest.prompt) {
+            if (
+                inputRequest.prompt !== PromptValue.NONE &&
+                inputRequest.prompt !== PromptValue.NO_SESSION
+            ) {
+                this.logger.warning(
+                    `SilentIframeClient. Replacing invalid prompt ${inputRequest.prompt} with ${PromptValue.NONE}`
+                );
+                inputRequest.prompt = PromptValue.NONE;
+            }
+        } else {
+            inputRequest.prompt = PromptValue.NONE;
         }
 
         // Create silent request
@@ -111,13 +116,7 @@ export class SilentIframeClient extends StandardInteractionClient {
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(
-            {
-                ...request,
-                prompt: request.prompt || PromptValue.NONE,
-            },
-            InteractionType.Silent
-        );
+        )(inputRequest, InteractionType.Silent);
         BrowserUtils.preconnect(silentRequest.authority);
 
         const serverTelemetryManager = this.initializeServerTelemetryManager(

package/src/interaction_client/SilentRefreshClient.ts

@@ -20,6 +20,7 @@ import {
     BrowserAuthErrorCodes,
 } from "../error/BrowserAuthError";
 import { AuthenticationResult } from "../response/AuthenticationResult";
+import { initializeBaseRequest } from "../request/RequestHelpers";
 
 export class SilentRefreshClient extends StandardInteractionClient {
     /**
@@ -35,12 +36,12 @@ export class SilentRefreshClient extends StandardInteractionClient {
         );
 
         const baseRequest = await invokeAsync(
-            this.initializeBaseRequest.bind(this),
+            initializeBaseRequest,
             PerformanceEvents.InitializeBaseRequest,
             this.logger,
             this.performanceClient,
             request.correlationId
-        )(request);
+        )(request, this.config, this.performanceClient, this.logger);
         const silentRequest: CommonSilentFlowRequest = {
             ...request,
             ...baseRequest,